System and method for communication between a master device and a slave device

ABSTRACT

A device includes a master device, a set of slave devices and a bus. The master device is configured to transmit first messages carrying a set of operation data message portions indicative of operations for implementation by slave devices of the set of slave devices, and second messages addressed to slave devices in the set of slave devices. The second messages convey identifiers identifying respective ones of the slave devices to which the second messages are addressed requesting respective reactions towards the master device within respective expected reaction intervals. The slave devices are configured to receive the first messages transmitted from the master device, read respective operation data message portions in the set of operation data message portions, implement respective operations as a function of the respective operation data message portions read, and receive the second messages transmitted from the master device.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.16/874,055, filed May 14, 2020, which application is a continuation ofU.S. patent application Ser. No. 14/360,229, filed Mar. 21, 2019, nowU.S. Pat. No. 10,678,726, which application claims priority to ItalianPatent Application No. 102018000003980, filed on Mar. 26, 2018, whichapplications are hereby incorporated herein by reference.

TECHNICAL FIELD

The description relates a communication method and corresponding systemsand devices.

BACKGROUND

Various applications, e.g., in the automotive field, involve exchange ofdata on one or more bus networks. High data rate, robustness, faultdetection, safety and low cost are desirable features for suchapplications.

Existing high data rate (e.g., 1 Mb/s) standardized vehiclecommunication systems may involve complex and accurate protocolcontrollers using external components. These may turn out to beexpensive, especially when implemented as single chip analog/bipolarApplication Specific Integrated Circuits (ASICs) and/or ApplicationSpecific Standard Products (ASSPs).

Vehicle lights (e.g., front, rear, and interior lights) are becomingincreasingly sophisticated and distributed (e.g., Matrix LED, ambientLED). Controlling such sophisticated and distributed systems may involvea high data rate control. Moreover, automotive-grade safety androbustness are desirable, especially for front and rear lightingsystems.

LED drivers can be cost-efficient, e.g., when employing single-chiptechnologies such as Bipolar-CMOS-DMOS (BCD) technology. It is otherwisenoted that high data rate protocol controllers using, e.g., BCDtechnology may be expensive and depend on an accurate clock source(crystal).

Differential wiring may be adopted for clock and data signals in orderto facilitate robustness, which may increase wire “harness” cost.

The increasing complexity of the communication network in a vehicle,e.g., for driving distributed lighting sources, such as LED matrices,may therefore lead to an increase in production costs which may behardly compatible with business models in the automotive industry.

One or more embodiments are applicable, for instance, to a CAN(Controller Area Network) bus. This is a well-known arrangement whichcan facilitate communication between, e.g., microcontrollers and deviceson board of a vehicle without a host computer. Operation of a CAN buscan be based on a message-based protocol, as dealt with in standardssuch as, e.g., ISO 11898-2:2015 and ISO 11898-2:2016.

SUMMARY

Embodiments relate to bus supported communication for use, e.g., inautomotive applications. For instance, one or more embodiments may beapplied to communication between electronic control units (ECUs) ofvehicle lights (e.g., front, rear, interior lights) and correspondinglighting modules, e.g., LED light modules.

Embodiments provide further improved solutions above those describedabove. For instance, embodiments may facilitate, e.g., realizingcost-effective high data rate vehicle networks for driving distributedLED light sources that comply with automotive requirements in terms ofrobustness, fault detection, and safety. Similar solutions may alsofacilitate realizing high data rate networks for implementation in,e.g., production automation systems or the like.

One or more embodiments may relate to a corresponding system.

One or more embodiments may relate to corresponding devices, e.g.,transmitter and receiver (interfaces) intended to work together.

One or more embodiments may relate to a corresponding signal.

One or more embodiments may relate to a corresponding vehicle, e.g., amotor vehicle such as a motor car.

One or more embodiments may provide a hardware solution, suitable torealize a communication network for communication between, e.g.,electronic control units (ECUs) and lighting modules such as LED lightmodules.

One or more embodiments may realize a master-slave communication businterface that can be used in automotive applications.

Such communication bus interface for use in automotive applications mayrely on the standardized CAN FD (Flexible Data-Rate) protocol fordriving light modules in a vehicle (“CAN FD Light”).

One or more embodiments may rely on network technologies other than astandardized CAN FD network, e.g., for use in non-automotiveapplications, such as, e.g., automation systems or the like.

For instance, one or more embodiments may use differential bus wiringand may provide a defined edge density (e.g., one recessive-to-dominantedge for each 10 bits) for synchronization purposes.

One or more embodiments may implement cyclic redundancy check (CRC) anderror checking for safety reasons.

In one or more embodiments, data exchange may rely on a master—slavescheme, wherein the “satellites”, that is the slaves, send data over thecommunication bus (only) upon request from the master device. Such anoperating scheme may not involve a collision-resolving feature, insofaras normal operation may aim at avoiding collisions, with collisionstreated as errors.

In one or more embodiments, normal operation of the communication busmay involve a master sending (regularly) data to the slaves. Such a(regular) data stream can be used by the slaves as a sort of network“heartbeat” or watchdog. If the regular data stream is not receivedwithin a defined time slot, the slaves can enter a fail-safe (orlimp-home) mode.

In one or more embodiments, data such as diagnosis data from the slaves,may be sought by the master, e.g., by using dedicated command frames. Acertain addressed slave may react on such a request within a certaintime frame. Such reactions can be used by the master to detect theavailability of slaves.

BRIEF DESCRIPTION OF THE DRAWINGS

One or more embodiments will now be described, by way of example only,with reference to the annexed figures, wherein:

FIG. 1 is exemplary of a possible implementation of embodiments;

FIG. 2 is exemplary of a possible implementation of a master device inembodiments;

FIG. 3 is exemplary of a possible implementation of a slave device inembodiments;

FIG. 4 is a diagram exemplary of a possible operation of embodiments;

FIG. 5 is a block diagram exemplary of a possible operation ofembodiments managing a “broadcast” frame;

FIG. 6 is a block diagram exemplary of a possible operation ofembodiments managing a “diagnosis” frame;

FIG. 7 is a block diagram exemplary of a possible operation ofembodiments managing an “error” frame;

FIG. 8 is a block diagram exemplary of a possible implementation of amaster communication cycle in embodiments; and

FIG. 9 is a block diagram exemplary of a possible implementation of aslave communication cycle in embodiments.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

In the ensuing description, one or more specific details areillustrated, aimed at providing an in-depth understanding of examples ofembodiments of this description. The embodiments may be obtained withoutone or more of the specific details, or with other methods, components,materials, etc. In other cases, known structures, materials, oroperations are not illustrated or described in detail so that certainaspects of embodiments will not be obscured.

Reference to “an embodiment” or “one embodiment” in the framework of thepresent description is intended to indicate that a particularconfiguration, structure, or characteristic described in relation to theembodiment is comprised in at least one embodiment. Hence, phrases suchas “in an embodiment” or “in one embodiment” that may be present in oneor more points of the present description do not necessarily refer toone and the same embodiment. Moreover, particular conformations,structures, or characteristics may be combined in any adequate way inone or more embodiments.

The references used herein are provided merely for convenience and hencedo not define the extent of protection or the scope of the embodiments.

As noted, one or more embodiments can provide a “robust” master-slavebus interface that can be used in automotive applications.

One or more embodiments may rely on a standardized CAN FD physicalinterface and protocol and exploit differential bus wiring whileproviding a certain edge density for synchronization purposes.

One or more embodiments may implement cyclic redundancy check (CRC) anderror checking for safety compliance.

The diagram of FIG. 1 is generally exemplary of an arrangement wherein afirst device 10 and a set of second devices 20 ₁, 20 ₂, . . . , 20 _(n),e.g., on board of a vehicle V, are coupled via a bus 30. For instance,the bus 30 may be a differential bus. A CAN bus is exemplary of suchpossible differential bus.

In such an arrangement as exemplified in FIG. 1, the first device 10transmits over the bus 30 “first” messages carrying a set of operationdata message portions, and the second devices in the set of seconddevices 20 ₁, 20 ₂, . . . , 20 _(n) identify in the first messagesrespective operation data message portions addressed to them and reactthereon by implementing respective operations.

As exemplified in FIG. 1, one or more embodiments may be applied tolocal communication bus networks, e.g., for driving LED clusters (e.g.,lights of a vehicle). In case such bus networks are compatible withstandard CAN FD networks, they are herein referred to as “CAN FD Light”networks.

It will be otherwise appreciated that reference to such possibleapplication is for exemplary purposes only and is not to be construed(even indirectly) as limiting the embodiments.

For instance, a communication system as exemplified in FIG. 1 may besuitable also for use with drivers for front lights and/or interiorlights of a vehicle.

Similar communication systems may be suitable for use with any othertype of ECUs and drivers (not necessarily within a vehicle), providedthat they can rely on a master-slave architecture.

FIG. 1 is exemplary of a system according to embodiments comprising amaster device 10, e.g., an electronic control unit (ECU) for, e.g., LEDclusters in rear lights in a vehicle.

It is again stressed that reference to such possible application is forexemplary purposes only and is not to be construed (even indirectly) aslimiting the embodiments.

One or more embodiments may include a plurality of “satellites” or slavedevices 20 ₁, 20 ₂, . . . , 20 _(n), e.g., (linear) LED driving circuitscommunicating with the master device, through a communication bus 30.

In one or more embodiments, both the master device 10 and the slavedevices 20 ₁, 20 ₂, . . . , 20 _(n) may be supplied with power from apower source 40, e.g., a battery provided within the vehicle.

In one or more embodiments, the master device 10 and the slave devices20 ₁, 20 ₂, . . . , 20 _(n) may be referred to different grounds.

A master device 10 as illustrated in FIG. 1 may comprise one or more ofthe following components: a main (e.g., “buck”) converter 101, anoptional (e.g., again “buck”) converter 102, a low-dropout (LDO) linearvoltage regulator, stand by, reset and window, and watchdog circuitblock 103, voltage supervisor, power good, oscillator and enable circuitblocks 104, a microcontroller 106, a transceiver circuit 105 forcommunication with other ECUs possibly mounted in the vehicle (e.g., aLIN2.2/HS-CAN transceiver), and an access point to an externalcommunication bus 107 connected to the transceiver 105 for communicationwith other ECUs comprised in the vehicle.

In one or more embodiments, the microcontroller 106 may be supplied fromthe main converter 101 and/or from the optional converter 102. Themicrocontroller 106 may be coupled with the circuit block 103 and withthe transceiver 105, and may be adapted for communication and/orcooperation with the communication bus 30.

Other than for the aspects discussed in the following, such anarchitecture for the master device 10 is conventional in the art, thusmaking it unnecessary to provide a more detailed description herein.

In one or more embodiments, the “master” functionality of the device 10may be implemented using a protocol controller embedded in themicrocontroller 106 and a CAN FD transceiver (not visible in FIG. 1).

For instance, in one or more embodiments as exemplified herein, themaster 10 is a microcontroller (μC) that handles bus communication. Sucha microcontroller may use an embedded CAN FD protocol controller thatcan handle the CAN FD protocol without the intervention of software.This may be a preferable choice over running via SW a differentcontroller that would occupy the resources of a microcontroller core andmay be undesirably slow. One or more embodiments thus facilitate reusingan existing hardware protocol controller, with CAN FD messages sent andtheir content controlled by software.

In one or more embodiments, the slave devices 20 may be implemented asLED drivers using BCD (BIPOLAR-CMOS-DMOS) technology.

In one or more embodiments, data exchange on the communication bus 30may rely on a master-slave scheme, wherein the slaves 20 ₁, 20 ₂, . . ., 20 _(n) may send data over the communication bus 30 (only) uponrequest from a master device 10.

As noted, in one or more embodiments such an operating scheme may notinvolve a collision-resolving feature, insofar as normal operation mayaim at avoiding collisions, with collisions treated as errors. Normaloperation of the communication bus 30 may involve the master 10 sendingregularly (i.e., in defined time intervals) data to the slaves 20 ₁, 20₂, . . . , 20 _(n) with such data received by (all) the slaves 20 ₁, 20₂, . . . , 20 _(n). Such a regular data stream may be used by the slavesas network “heartbeat” or watchdog. As a result of the regular datastream not being received within a defined time slot, the slaves canenter their fail-safe (or limp-home) mode.

In one or more embodiments, data such as diagnosis data from the slaves20 ₁, 20 ₂, . . . , 20 _(n) may be requested by the master 10 by usingdedicated command frames, e.g., “second” messages sent by the master 10over the bus 30. A certain (one) addressed slave 20 may react, e.g.,answer a request issued by the master within a certain time frame. Suchan answer, sent by the slave 20 over the bus network 30, can be used bythe master 10 to detect the availability and/or the correct operation ofthe slave 20 _(i).

It will be appreciated that the first messages discussed hereinessentially correspond to broadcast messages as conventionallytransmitted in a message-based protocol such as, e.g., a CAN busprotocol where messages transmitted over the bus by one device are(simultaneously) received by (all) the other devices, with these latterdevices capable of implementing respective operations as a function ofoperation data portions conveyed by such broadcast messages. Whileso-to-say “physically” broadcast over the bus by one (master) device,the second messages are in fact “logically” addressed to individual onesof the other (slave) devices essentially as request messages whereby theslave devices are requested to react by sending towards the masterdevice—within a certain time interval—a respective response such ase.g., a diagnostic message, with possible collisions of such responsesavoided insofar as the master device allots respective, non-colliding,response intervals to the slave devices.

It will also be noted that, in the framework of the present description,both the terms “frame” and “message” may be used to indicate messagesexchanged amongst participants in the communication bus 30.

In one or more embodiments, the communication protocol may use (only)CAN FD format frames, without bit rate switching and with standard ID.

Extensions like supporting extended ID, classic CAN frames or bit rateswitching may be optionally included. Frames that are not supported bythe implementation can be ignored, with bits intended for changing theseoperation modes kept at their fixed value.

FIG. 2 is a block diagram exemplary of a possible implementation of amaster device 10 according to embodiments.

Throughout the figures annexed herein, like parts or elements areindicated with like references/numerals and a corresponding descriptionwill not be repeated for brevity.

Therefore, FIG. 2 shows a master device 10 which may comprise an accesspoint to a communication bus 30, e.g., a CAN bus, an access point to asecond communication bus 107, a transceiver circuit 105 for cooperationwith the communication bus 107, a transceiver circuit 108, e.g., a CANFD transceiver, for cooperation with the communication bus 30, and amicrocontroller 106, in turn comprising a (HW and/or SW) communicationprotocol controller 1062, e.g., a CAN FD protocol controller, acommunication protocol extension (e.g., SW) 1061, e.g., a “CAN FD Light”protocol extension, and possibly other circuit blocks 1063.

In one or more embodiments, an additional CAN FD protocol extension 1061may control the CAN FD protocol controller 1062 for implementing themaster side of the CAN FD Light protocol as exemplified herein.

In one or more embodiments, access to the physical interface of the bus30 may be provided by using an otherwise conventional CAN FD transceiver108.

FIG. 3 is a block diagram exemplary of a possible implementation of aslave device 20 _(i) according to embodiments.

As exemplified in FIG. 3, a slave device 20 _(i) may comprise acommunication and protocol controller circuit 201, e.g., a “CAN FDLight” communication and protocol controller, memory areas 202, atransceiver 203, e.g., a CAN FD transceiver, for cooperation with thecommunication bus 30, and possibly other ECU circuit blocks 204.

Other than for the aspects discussed in the following, such anarchitecture for the slave devices 20 _(i) is conventional in the art,thus making it unnecessary to provide a more detailed descriptionherein.

For instance, in one or more embodiments, the implementation of thecommunication and protocol controller circuit 201 may be by means ofapplication-specific hardware to reduce the necessity of embeddedprocessors for running software.

In one or more embodiments, the communication and protocol controllercircuit 201 may comprise an accurate oscillator (not visible in FIG. 3)for use in generating and sampling the data bits.

FIG. 4 is a diagram exemplary of a possible operation of a communicationand protocol controller circuit 201, e.g., a CAN FD Light communicationand protocol controller circuit.

A communication and protocol controller 201 as exemplified in FIG. 4comprises a communication controller 2010, a protocol controller 2011,in turn comprising a transmitter circuit 2012, a Transmit Error Counter(TEC) circuit 2013, a receiver circuit 2014 and a Receive Error Counter(REC) circuit 2015, and an oscillator 2016, optionally of a voltage,process and temperature compensated type and/or correspondingly trimmed.

In one or more embodiments, the transmitter circuit 2012 and/or thereceiver circuit 2014 may be configured to cooperate with thetransceiver 203, e.g., a CAN FD transceiver, for communication over thebus 30.

In one or more embodiments, the transmitter circuit 2012 may beconfigured to perform frame preparation (2012 a), bit stuffing (2012 b),CRC insertion (2012 c), frame error check (2012 d), error counting (2012e) and acknowledge (2012 f).

In one or more embodiments, the receiver circuit 2014 may be configuredto perform bit decoding (sampling —2014 a), error detection (2014 b),bit destuffing (2014 c), CRC verification (2014 d) and acknowledgegeneration (2014 e).

In one or more embodiments, the communication controller 2010 may sendand receive data to and from the protocol controller 2011 to control thecommunication.

In one or more embodiments, applying a master-slave architecture to aCAN FD based communication bus 30 may provide the possibility ofexploiting the advantages of the CAN FD protocol (e.g., high data rate,robust differential signaling, CRC for safety purposes) while overcomingits drawbacks, for instance the requirement of an accurate clock timingfor multilateral communication (e.g., for arbitration, error signaling,frame check by every ECU), the high complexity, and the absence ofguaranteed communication slots due to the absence of a centralcommunication master.

In one or more embodiments as exemplified herein, high bandwidth (e.g.,500 kb/s, preferably 1 Mb/s) may be employed and the communication mayinvolve checking for ASIL B (Automotive Safety Integrity Level B) safetyrequirements. For instance, fulfilling such safety requirements may befacilitated by a CRC value that is sent with each data frame.

In one or more embodiments as exemplified herein, as a result ofreceiving a data frame, e.g., a “first” message sent by the master 10over the bus 30, the recipients (slaves 20 ₁, 20 ₂, . . . , 20 _(n))send an “acknowledge” bit so that at least one acknowledge bit isreceived by the sender (master 10) if the system operates correctly.

Therefore, as a result of receiving at least one acknowledge bit fromthe slaves 20 ₁, 20 ₂, . . . , 20 _(n), the master 10 can detect if itis still coupled to the bus network 30. Since the participants of thebus network 30 are connected to a same wire, a transmitter may be ableto detect if it is not correctly operating, and can consequently enter a“passive” state to not perturb the bus communication.

In one or more embodiments, a participant of the bus network 30 in apassive (e.g., recessive) state may be able to sense the value of thebus differential voltage but may not be able to drive the bus, that isit may not be able to force a certain value of the bus differentialvoltage.

In one or more embodiments, the data sampling clock may be generated inthe receiver circuits individually. A minimum edge density of the datastream will thus be beneficial, e.g., with a recessive-to-dominant edgeat least every e.g., loth bit, thus facilitating a synchronization ofthe receiver circuit to the data stream.

In one or more embodiments, a differential bus network facilitates“robust” data transfer at low cost. In one or more embodiments, also awake-up over the network may be implemented, and the slaves 20 ₁, 20 ₂,. . . , 20 _(n) may be woken up using a wake-up pattern (WUP) accordingto the ISO 11898-2:2015 standard, e.g., using a filter timeT_(filter)(short).

One or more embodiments may thus take advantage of a conventional CAN FDprotocol, e.g., at 1 Mb/s, without bit rate switching for compatibilityreasons. Therefore, compatibility may be sought by implementing (in anotherwise conventional CAN FD protocol controller) (only) a subset offeatures of a conventional CAN FD protocol (e.g., not implementing thebit rate switching feature).

A communication network as described herein lends itself to use withnotionally any CAN and/or CAN FD protocol “flavors”.

For instance, in one or more embodiments as exemplified herein:

(only) the CAN FD Base Frame Format (FBFF) may be used, without havingto resort to an extended ID, e.g., in order to increase the data payloadof each frame (for instance, up to 64 bytes per frame);

(only) one frame format (FBFF) may be supported, with the bits in thecontrol field fixed and extended ID (EID, IDE bit always dominant), bitrate switch (BRS, always dominant) and error state indication (ESI,always dominant) not requiring to be supported: e.g., FD frame (FDF) maybe (steadily) set to recessive.

In one or more embodiments, supporting (only) one frame format, e.g.,the CAN FD Base Frame Format, may result in a simpler implementation andmay facilitate cost reduction.

The data field in a CAN FD Base Frame Format can be up to 64 bytes long.

Depending on the number of data bytes, either CRC17 or CRC21 may becalculated. In one or more embodiments, (only) one CRC delimiter bit maybe sent and accepted.

In one or more embodiments, network participants 20 may comprise areceive error counter (REC) 2015 and a transmit error counter (TEC)2013.

In one or more embodiments, as a result of the receive error counter2015 in the network participant 20 amongst the network participants 20₁, 20 ₂, . . . , 20 _(n) reaching a certain threshold, the coupling ofthe network participant 20 to the communication bus 30 may be assumed tobe lost.

In one or more embodiments, as a result of the transmit error counter inthe network participant 20 amongst the network participants 20 ₁, 20 ₂,. . . , 20 _(n) reaching a certain threshold, the node 20 _(i) may stopsending data and enter a passive state (recessive state) to avoidperturbing the bus.

In one or more embodiments, the transmit error counter of any of thenetwork participants 20 ₁, 20 ₂, . . . , 20 _(n) can be reset by acommand from the master 10, which can be sent to a certain participant20 _(i) as a result of no data from node 20 _(i) being received for acertain period of time. Receiving a reset command in a certain slave 20_(i) may unlock that slave, which may have entered into passive statedue e.g., to some exceptional condition (e.g., distortion).

One or more embodiments may adopt REC/TEC insofar as these are (already)provided for in the CAN bus “de facto” standard.

A safety concept of one or more embodiments can be built on themaster-slave protocol structure and operation involving sending ofmessages within a given time frame and the correctly receiving thesemessages.

One or more embodiments may contemplate circumstances as discussed inthe following:

a. TEC threshold exceeded

-   -   i. TEC in master: the master is aware of being no longer coupled        to the slaves->a warning message is issued (e.g., to the driver:        lamp, dashboard message, etc.)    -   ii. TEC in slave: a certain slave is aware of its inability to        send diagnostic messages to the master->enter fail-safe state        (“limp-home”), e.g., LED backlight turned on

b. REC threshold exceeded

-   -   i. REC in master: network “distorted” (e.g., shorted cables or        other reasons)->master will send fail-safe commands to the        slaves and issue a warning message (e.g., to the driver)    -   ii. REC in slave: network “distorted”->slaves will stop        communication (thus will avoid the potential risk that the bus        is blocking the communication of the other slaves) and enter the        fail-safe state

c. Master sends “first” message

-   -   i. Master receives no acknowledge->TEC increases in master, with        the same reaction discussed above    -   ii. Slaves do not receive “first” messages in a given time        frame->network distorted (same as REC failure in slaves, with        the same reaction discussed above)

d. Master sends “second” message

-   -   i. Master receives no acknowledge (ACK)->same reaction discussed        above    -   ii. Master does not receive an answer from the addressed        slave->network distorted (at least at the slave concerned, with        the same reaction discussed above)    -   iii. Slave does not receive the “second” message->No action;        communication is verified by the “first” messages, with the same        reaction as discussed above in that respect

e. Slave answers to a “second” message by sending a diagnosis frame

-   -   i. Master does not receive the diagnosis frame within a certain        time frame or receives a distorted answer->network distorted (at        least at the slave concerned, with the same reaction as        discussed above for REC failure in master)    -   ii. Slave does not receive an acknowledge: network        distorted->same reaction as discussed above for TEC failure in        slave; in the possible absence of TEC in slaves (see also below)        no reaction is provided and communication is verified by the        reception of “first” messages from the master.

As noted, one or more embodiments may contemplate “dropping” the REC/TECconcept for the slaves while retaining it (only) in the master, e.g., asa part of the original CAN (FD) protocol, so that (only) the master willevaluate its TEC/REC.

In one or more embodiments, in a fail-safe/limp-home situation, theslaves (e.g., the LED drivers of the backlights in a car) will enter asafe state, e.g., with the backlights (at least partly) turned on so thecar can still be seen by other drivers in the dark, while discontinuingother ancillary functions that may increase power consumption, in orderto avoid e.g., over-temperature or other failures.

Of course, the type and nature of a fail-safe/limp-home situation mayvary as a function of the kind of slave involved: e.g., interior lightsmay be simply turned off to avoid annoyance of a driver during nightdriving.

In one or more embodiments, the master may also enter a fail-safe stateif its network connection to the main controller (chassis/bodycontroller, a higher level controller) through the bus 107 fails. As aresult of the master entering a fail-safe state, the master may send acommand to the slaves coupled therewith to enter respective fail-safestates. Also, the master may react to network distortions by alertmessages, e.g., by informing the driver via warning lamp and/ordashboard messages.

In one or more embodiments, any sender may receive from at least onereceiver an acknowledge (“ACK”) bit as a result of the receiverreceiving correctly a data frame. Therefore, the sender can identify ifit is still coupled to at least a part of the network. For instance, thetransmit error counter of the sender is increased as a result of no ACKbits being received by the sender.

For instance, in one or more embodiments as exemplified herein, themaster 10 will send out messages in a regular time period that can beused as “watchdog trigger” and/or network “heartbeat”. Therefore, thereceiving slaves 20 ₁, 20 ₂, . . . , 20 _(n) can recognize if the master10 is communicating. The master 10 may request status information fromeach connecting slave 20 periodically. In case a slave 20 amongst theslaves 20 ₁, 20 ₂, . . . , 20 _(n) does not answer to the statusinformation request issued by the master 10, the “absence” (e.g.,failure) of the slave 20 _(i) can be detected.

For instance, in one or more embodiments as exemplified herein, anysender may be configured to compare the bits it sends over thecommunication bus 30 with the bits received on the bus 30. As a resultof the bits sent and received being found not to be equal, the presenceof an error may be assumed and the transmit error counter of the sendertherefore increased. The sender node may stop transmitting data as aresult of the corresponding TEC reaching a certain threshold, causingthe sender to enter a passive state.

For instance, in one or more embodiments as exemplified herein, receivedframes may be verified for correctness, e.g., by checking one or more ofthe following features:

the correctness of the received CRC, the receipt of one recessive bit asCRC delimiter following the CRC field, the correctness of the bitstuffing of the received frame.

In one or more embodiments, as a result of the received CRC failing tomatch the received frame, the received frame may be discarded and theREC of the receiver may be increased.

In one or more embodiments, as a result of the bit stuffing of thereceived frame being incorrect, the received frame may be discarded andthe REC of the receiver may be increased.

In one or more embodiments, transmitted frames may be verified forcorrectness, e.g., by checking one or more of the following features:

the equality between the bits sent and the bits received, since sentbits are also received by the transceiver circuit;

the acknowledgment of transmitted frames by at least one receivercircuit, by issuing an ACK bit from at least one receiver.

In one or more embodiments, as a result of bits sent and the bitsreceived being found not to be identical, the transmitted frame may beconsidered invalid, with transmission aborted and the TEC of thetransmitter increased.

In one or more embodiments, as a result of the transmitter circuitfailing to receive any ACK bit from the receivers, the transmitted framemay be considered as not received by any of the receivers, the TEC ofthe transmitter may be increased and the transmitted frame may not beresent.

In one or more embodiments, the oscillators 2016 of the slave devices 20₁, 20 ₂, . . . , 20 _(n) may have a maximum allowed deviation of theiroscillation frequency, for instance ±2% of the expected value.Therefore, the maximum frequency offset between two slaves in one ormore embodiments can reach a maximum value, for instance up to ±₄% ofthe oscillation frequency.

In one or more embodiments, the frames sent by one slave may not beintended to be decoded by another slave on the same communication bus30. As a result of a slave receiving a frame sent by another slave, thereceive error counter of the first slave may increase. Error frames arenot transmitted by the slaves, so the communication is not distorted.

Therefore, in one or more embodiments, the REC of a receiver may bedecreased as a result of receiving an error-free frame, according to thelength of such received frame, as exemplified in Table 1 in thefollowing.

In one or more embodiments, the REC of a receiver may be decreased byone unit for Data Length Codes (DLC) up to 8, e.g., according to CANPartial Networking (CAN PN), which works with the classic CAN ExtendedFrame Format (CEFF). In the case of longer frames, the REC may bedecreased according to the number of classic CAN frame data payloads. Inone or more embodiments, such behavior may be accounted for in thecommunication controller 2010 since many frames originating from slavesmay not be recognized by the other slaves in the communication bus 30.In the worst case, (all of) the frames originating from slaves may notbe recognized by the other slaves in the communication bus 30. Moreover,the REC of the receivers may be increased by more than one unit perreceived frame, since stuffing errors, CRC errors and CRC delimitererrors may add up.

In one or more embodiments, the master will send more 8-byte datapackets for each slave response than the slave. In fact, in one or moreembodiments, slave responses may be shorter (e.g., carrying a lowernumber of data bytes) than frames sent by the master.

In order to “compensate” for slave responses sent by one slave over thebus 30 leading to other slaves coupled to the bus 30 increasing theirREC, long frames sent by a master being correctly received by slaves maydecrease the REC of the slaves by an amount according to the length ofthe frame sent by the master, as exemplified in Table 1.

TABLE 1 DLC and REC update Number Of Data length code (DLC) Data REC RECFrames DLC3 DLC2 DLC1 DLC0 Bytes decrease increase Classical 0 0 0 0 0 11 Frames 0 0 0 1 1 and 0 0 1 0 2 FD Frames 0 0 1 1 3 0 1 0 0 4 0 1 0 1 50 1 1 0 6 0 1 1 1 7 1 0 0 0 8 Classical 1 0 or 1 0 or 1 0 or 1 8 1Frames FD Frames 1 0 0 1 12 2 1 0 1 0 16 1 0 1 1 20 3 1 1 0 0 24 1 1 0 132 4 1 1 1 0 48 6 1 1 1 1 64 8

FIG. 5 is a block diagram exemplary of a possible logic flow describingthe “broadcast” frame protocol implemented in one or more embodiments,e.g., for a master sending a “first” message and a slave receiving suchmessage.

In FIG. 5, the logic blocks that lie at the left of the thick verticalline are indicative of operations implemented in the master device 10,and the logic blocks that lie at the right of the thick vertical lineare indicative of operations implemented in any slave device 20 _(i)amongst the slave devices 20 ₁, 20 ₂, . . . , 20 _(n).

The meaning of the logic blocks in FIG. 5 is the following:

-   -   300: send “first” message with broadcast ID,    -   301: receive “first” message,    -   302: detect error in received “first” message (Y=error detected,        N=error not detected),    -   303: increase REC of the slave upon positive (Y) outcome of        block 302,    -   304: end transmission,    -   305: send ACK bit upon negative (N) outcome of block 302,    -   306: decrease REC of the slave,    -   307: end with state “reception successful”,    -   308: receive ACK bit,    -   309: detect error in received ACK bit (Y=error detected, N=error        not detected),    -   310: end with state “transmission successful” upon negative (N)        outcome of block 309,    -   311: optionally increase TEC of the master, and send error frame        upon positive (Y) outcome of block 309,    -   312: end transmission,    -   313: receive error frame,    -   314: increase REC of the slave,    -   315: end transmission.

The operation described by the block diagram of FIG. 5 is also brieflydiscussed in the following for the sake of ease of understanding.

As exemplified in FIG. 5, in one or more embodiments a “first” messagemay be transmitted from the master 10 to the slaves 20 ₁, 20 ₂, . . . ,20 _(n) to set operation values, for instance setting actuator values.

In one embodiment, a “first” message may contain the setting values forall the slaves 20 ₁, 20 ₂, . . . , 20 _(n) connected to thecommunication bus 30.

In another embodiment, a “first” message may contain the setting valuesfor a subset of slaves amongst all the slaves 20 ₁, 20 ₂, . . . , 20_(n) connected to the communication bus 30, e.g., even for a singleslave amongst the slaves 20 ₁, 20 ₂, . . . , 20 _(n).

In one or more embodiments, the master 10 may not expect an answer backfrom the slaves 20 ₁, 20 ₂, . . . , 20 _(n) after sending a “first”message, but it may expect at least one acknowledge bit from at leastone slave, e.g., in the CAN acknowledge slot.

In one or more embodiments as exemplified herein, as a result of themaster 10 failing to receive any acknowledge bit from at least one slavee.g., in the CAN acknowledge slot, the master 10 will increase the valueof its transmit error counter. In one or more embodiments, the master 10may also send an error frame on the communication bus 30.

In one or more embodiments as exemplified herein, the slaves 20 ₁, 20 ₂,. . . , 20 _(n) may check the integrity of a received “first” messageand send an acknowledge bit if the received “first” message iserror-free, with the “first” message considered valid in such a case. Inone or more embodiments, receiving an additional error frame will resultin the receive error counter increasing without any additional reaction.

In one or more embodiments, the slaves 20 ₁, 20 ₂, . . . , 20 _(n) maypick the data from the “first” message which is valid for them. In oneor more embodiments, “first” messages may carry a broadcast-ID, e.g., inthe standard-ID field of a CAN message.

FIG. 6 is a block diagram exemplary of a possible logic flow describingthe diagnosis frame protocol implemented in one or more embodimentse.g., for a master sending a “second” message and a slave receiving suchmessage and reacting thereon.

As in FIG. 5, the logic blocks that lie at the left of the thickvertical line in FIG. 6 are indicative of operations implemented in themaster device 10, and the logic blocks that lie at the right of thethick vertical line are indicative of operations implemented in anyslave device 20 _(i) amongst the slave devices 20 ₁, 20 ₂, . . . , 20_(n).

The meaning of the logic blocks in FIG. 6 is the following:

-   -   400: send “second” message with (target) slave ID,    -   401: receive “second” message,    -   402: detect error in received “second” message (Y=error        detected, N=error not detected),    -   403: increase REC of the slave upon positive (Y) outcome of        block 402,    -   404: end transmission,    -   405: send ACK bit upon negative (N) outcome of block 402,    -   406: decrease REC of the slave,    -   407: wait 10 bits bus idle,    -   408: detect error (Y=error detected, N=error not detected),    -   409: send reaction message with slave ID,    -   410: receive ACK bit,    -   411: detect error in received ACK bit (Y=error detected, N=error        not detected),    -   412: increase TEC of the master and send error frame upon        positive (Y) outcome of block 411,    -   413: receive error frame,    -   414: increase REC of the slave,    -   415: end transmission,    -   416: wait TREC,    -   417: check if TREC timeout is reached (Y=TREC timeout reached,        N=TREC timeout not reached),    -   418: trigger watchdog failure upon positive (Y) outcome of block        417,    -   419: receive reaction message upon negative (N) outcome of block        417,    -   420: detect error in received reaction message (Y=error        detected, N=error not detected),    -   421: increase REC of the master and send error frame upon        positive (Y) outcome of block 420,    -   422: receive error frame,    -   423: increase TEC and REC of the slave,    -   424: end transmission,    -   425: send ACK bit upon negative (N) outcome of block 420,    -   426: decrease REC of the master,    -   427: end with state “reception successful”,    -   428: receive ACK bit,    -   429: detect error in received ACK bit (Y=error detected, N=error        not detected),    -   430: increase TEC of the slave upon positive (Y) outcome of        block 429,    -   431: end transmission,    -   432: decrease TEC of the slave upon negative (N) outcome of        block 429,    -   433: end with state “transmission successful”.

The operation described by the block diagram of FIG. 6 is also brieflydiscussed in the following for the sake of ease of understanding.

As exemplified in FIG. 6, in one or more embodiments the master 10 maysend a “second” message to request diagnosis data from a certain slave20 _(i) amongst the slaves 20 ₁, 20 ₂, . . . , 20 _(n) connected to thecommunication bus 30 by including the identification slave ID of slave20 _(i) into the message ID, e.g., in the standard-ID field of a CANmessage. The master 10 may wait for the answer, e.g., a reactionmessage, from the addressed slave within a specific time window TREC. Asa result of the master 10 not receiving an answer within that timewindow TREC, a watchdog error may be triggered.

In one or more embodiments, as a result of correctly receiving a“second” message sent by the master 10 over the bus 30, the slave 20replies with an ACK bit in the ACK slot and sends its reaction messageafter waiting for a certain time interval, e.g., at least 10 bits of busidle.

In one or more embodiments, other slaves amongst the slaves 20 ₁, 20 ₂,. . . , 20 _(n) may receive reaction messages incorrectly (e.g., due tothe frequency offset of the respective oscillators with respect to thefrequency of the master 10). As a result of incorrectly receiving suchreaction messages, the RECs of the receiving slaves 20 ₁, 20 ₂, . . . ,20 _(n) may be increased.

In one or more embodiments as exemplified herein, slaves not addressedby the “second” messages issued by the master 10 will not answer andignore the reaction messages sent by the addressed slaves.

In one or more embodiments as exemplified herein, frames will (only) betransmitted by the slaves 20 ₁, 20 ₂, . . . , 20 _(n) upon request fromthe master 10. Therefore, slaves 20 ₁, 20 ₂, . . . , 20 _(n) will notretransmit any frame in case of an error occurring.

In one or more embodiments as exemplified herein, “second” messages maybe labeled by the ID of the addressed slave. Optionally, “second”messages can be labeled as broadcast frames by using unused ID bits inthe standard-ID field (e.g., the lower 10 bits of the standard-ID fieldmay denote the addressed slave while the 11th bit may mark the frame asa broadcast frame).

FIG. 7 is a block diagram exemplary of a possible logic flow describingthe error and overload frame protocol implemented in one or moreembodiments.

As in FIGS. 5 and 6, the logic blocks that lie at the left of the thickvertical line in FIG. 7 are indicative of operations implemented in themaster device 10, and the logic blocks that lie at the right of thethick vertical line are indicative of operations implemented in anyslave device 20 _(i) amongst the slave devices 20 ₁, 20 ₂, . . . , 20_(n).

The meaning of the logic blocks in FIG. 7 is the following:

-   -   500: detect error (Y=error detected, N=error not detected), sol:        end with state “transmission successful” upon negative (N)        outcome of block 500,    -   502: increase TEC of the master and send error frame upon        positive (Y) outcome of block 500,    -   503: end transmission,    -   504: receive error frame,    -   505: increase REC of the slave,    -   506: end transmission.

The operation described by the block diagram of FIG. 7 is also brieflydiscussed in the following for the sake of ease of understanding.

In one or more embodiments, error frames are (only) sent by the master10, not by the slaves 20 ₁, 20 ₂, . . . , 20 _(n). Receiving an errorframe may lead the RECs of the slaves to increase by one. The samebehavior may be applied in the case of overload frames, which aretreated as error frames.

In one or more embodiments, the bus participants (slaves 20 _(i), 20 ₂,. . . , 20 _(n)) may not arbitrate the communication on the bus 30,since the communication may be initiated and/or controlled (only) by themaster 10.

In one or more embodiments as exemplified herein, any collision on thebus 30 will lead to an increase of an associated error counter. Themaster 10 may detect collisions as errors and increase its transmiterror counter, without necessarily re-sending the frame. A slave amongstslaves 20 ₁, 20 ₂, . . . , 20 _(n) may detect wrong bits on the bus 30(e.g., a dominant bit instead of an expected recessive) and increase itstransmit error counter.

One may note that error messages are, so-to-say, error themselves, thatis they may not comply with CAN protocol requirements. They may simplybe a set of, e.g., six, dominant bits in a row. Thus they can be viewedas an error and dropped, with no reaction on the slave side to these.

A concept underlying one or more embodiments is to reset the watchdogtimer (only) upon a correct reception of a “first” message and/or a“second” message, insofar as “first” messages and “second” messages arethe (only) messages that are sent by the master.

FIG. 8 is a block diagram indicative of a possible implementation of acommunication cycle of a master unit 10 in one or more embodiments.

The meaning of the logic blocks in FIG. 8 is the following:

-   -   600: start communication,    -   601: decide if a request for diagnosis data should be issued to        slave 20 _(i) (Y=issue diagnosis data request to slave 20 _(i),        N=do not issue diagnosis data request to slave 20 _(i)),    -   602: send “second” message to slave 20 _(i) upon positive (Y)        outcome of block 601,    -   603: reset watchdog timer of slave 20 _(i),    -   604: check if reaction message with diagnosis data from slave 20        _(i) is received (Y=diagnosis data received, N=diagnosis data        not received),    -   605: check if watchdog timer of slave 20 _(i) is expired        (Y=watchdog expired, N=watchdog not expired),    -   606: sense watchdog timeout for slave 20 _(i), upon positive (Y)        outcome of block 605,    -   607: send “first message”, upon negative (N) outcome of block        601,    -   608: optionally wait for T_(wait).

In one or more embodiments, the master 10 may send “first” messages,e.g., for actuator setting, (e.g., cyclically) to the slaves 20 ₁, 20 ₂,. . . , 20 _(n), which may use such a cycle as watchdog trigger. As aresult of a “first” message not being received by a slave 20 _(i) withinthe watchdog time, a watchdog timeout may be sensed. As a result of awatchdog timeout being sensed, the slave 20 _(i) may enter a fail-safestate.

In one or more embodiments, the master 10 may request diagnosis datafrom a certain addressed slave 20 _(i). As a result of the addressedslave 20 _(i) not answering within a certain amount of time, a watchdogtimeout may be triggered, so the master can act on a loss ofcommunication with the slave 20 _(i).

In one or more embodiments as exemplified herein, data can be sent tothe slaves 20 ₁, 20 ₂, . . . , 20 _(n) in at least two differentmanners.

In a first case, a “first” message can be sent by the master 10 to allslaves 20 ₁, 20 ₂, . . . 20 _(n). In such case, the master device 10 maynot expect an answer from the slaves 20 ₁, 20 ₂, . . . , 20 _(n).

In a second case, a “second” message can be sent by the master 10 to aspecific slave 20 _(i). The slaves 20 ₁, 20 ₂, . . . , 20 _(n) may treata “second” message as a broadcast frame, e.g., for actuator setting.(Only) the addressed slave can thus react on a “second” message bysending its diagnosis data back in a reaction message. Such diagnosisdata will be ignored by the other slaves on the bus 30. Due to thefrequency offset between the slaves, the reaction message sent by one ofthe slaves may be seen as an erroneous frame by the other slaves and maylead to an increase of their respective RECs.

In one or more embodiments, the “second” message may also be a dedicatedframe which may be ignored by the other slaves.

In one or more embodiments, “first” messages may use a specifiedbroadcast ID and “second” messages may contain the ID of the addressedslave.

In one or more embodiments, the remaining bits available in the standardID field may be used to distinguish between a diagnosis request sendingdata to the slaves and a specific request to the addressed slave only.

FIG. 9 is a block diagram indicative of a possible implementation of acommunication cycle of the slave units 20 ₁, 20 ₂, . . . , 20 _(n) inone or more embodiments.

The meaning of the logic blocks in FIG. 9 is the following:

-   -   700: start communication,    -   701: reset watchdog timer,    -   702: detect if a valid message is received (Y=valid message        received, N=no valid message received),    -   703: determine if the valid message received is a “first”        message or a “second” message, upon positive (Y) outcome of        block 702 (Y=“first” message received, N=“second” message        received),    -   704: send reaction message with diagnosis data upon negative (N)        outcome of block 703,    -   705: check if watchdog has expired, upon negative (N) outcome of        block 702 (Y=watchdog expired, N=watchdog not expired),    -   706: issue a watchdog fail, upon positive (Y) outcome of block        705.

In one or more embodiments, the master 10 sends data to the slaves 20 ₁,20 ₂, . . . , 20 _(n) (e.g., cyclically). Such data may be used by theslaves to reset respective watchdogs. In case no frame intended forresetting the respective watchdog is received by a slave before thewatchdog expires, a watchdog fail may be set. Such watchdog fail may beused by the slave to enter a fail-safe state.

In one or more embodiments, as a result of a slave 20 receiving a“second” message addressed thereto, a receiving slave 20 _(i) willanswer by sending a reaction message containing the requested diagnosisdata.

In one or more embodiments, a master 10 may send e.g., 64 bytes (i.e.512 bits, one byte being equal to 8 bits) of data in a single dataframe. The bus participants, e.g., the slaves 20 ₁, 20 ₂, . . . , 20_(n), will receive such data sent from the master 10. Therefore, a slavemay “pick” the information it needs from any set of the 512 bits of datareceived from the master 10. This kind of frame is called a “first”message.

The number of bits that a slave may read in a certain “first” messagemay vary depending on the specific embodiment of the communication bus.The position of the data of a certain slave may be determined during aninitialization sequence.

For instance, each slave may read 8 bits of data in a “first” message.If the total amount of data sent by the master 10 in a certain “first”message is equal to, e.g., 64 bytes (i.e. 512 bits), up to 64 slaves canbe provided with data per “first” message. Once the amount of data sentby the master 10 in a “first” message as well as the amount of data readby the slaves in a “first” message are defined, a maximum number ofslaves addressable by a “first” message can be correspondingly defined.

In one or more embodiments, the number of possible bus participants(i.e. the number of slaves) may be increased by providing “chains” ofslaves. In that case, a first “first” message may address a first chainof slaves (comprising, e.g., 64 slaves), a second “first” message mayaddress a second chain of slaves, and so on. The slave chains may beaddressed by a dedicated ID in the message ID field, e.g., a CAN FD IDfield.

In one or more embodiments, a slave may be addressed individually byusing its slave address and the addressed slave will react on thisdiagnosis request frame.

In one or more embodiments, embedding a protocol such as, e.g., the STSPI (Serial Peripheral Interface) 4.1 protocol developed by companies ofthe ST Group into the data of the “second” messages sent by the master10 and reaction messages sent by the slaves 20 ₁, 20 ₂, . . . , 20 _(n)will facilitate reading or writing certain data to certain addresses.

In one or more embodiments, an SPI command according to the ST SPIprotocol embedded into the data of the “second” message from the mastermay consist of a memory address and a number of data bytes for therequest (read/write). The slave may respond according to the ST SPIprotocol with a specific byte instead of the address and the data bytesof the requested memory address. Such specific byte is called the“global status byte” (GSB) and contains important status bits, suchstatus bits being indicative of, e.g., an error occurred, a resetoccurred, etc. Therefore, the global status register may be sent backwith every diagnosis response.

In one or more embodiments, “first” messages are transmitted by themaster 10 to (all) slaves 20 ₁, 20 ₂, . . . , 20 _(n) in the bus network30. The ID field of a “first” message may contain the identificationnumber of a chain that is addressed by the “first” message. Slavesbelonging to the addressed chain may pick their data from the datatransferred by the frame (e.g., a maximum of 64 bytes of data). Thenumber of data bits read by a slave will be defined at theimplementation of the function (e.g., being a so-called “hard-coded”value). The position of the data directed to a certain slave of anaddressed chain in the overall data field of a “first” message may bedetermined during the chain initialization.

In one or more embodiments, a “first” message may use, for instance, an11-bit frame ID starting with ‘1’ followed by three ‘1’s and theaddressed chain identification number, e.g., a 7-bit number. Forexample, using chain identification numbers encoded in e.g., five bitsallows the identification and assignment of up to 64 slave chains, witheach chain comprising, e.g., up to 63 slaves.

In one or more embodiments, a specific “first” message, herein called“initialization frame”, may be sent to the slaves 20 ₁, 20 ₂, . . . , 20_(n) in the communication bus 30 to set their “membership” in a certainchain and their relative positions within the chain. As a result ofreceiving an initialization frame, the slaves will be put in a conditionto read the data intended for them from the broadcast frames receivedover the communication bus 30. For instance, the number of bits read bya slave in a certain “first” message may be the same for all the slavesand defined at the bus implementation (e.g., a hard-coded value).

In one or more embodiments, the ID for a chain initialization frame maybe, e.g., “1_0110_0000_00”.

In one or more embodiments, a slave may read e.g., three bytes of datafrom an initialization frame, for instance the first byte beingindicative of the chain it belongs to, the second byte being indicativeof its position inside the chain, and the third byte being indicative ofthe addressed slave. Therefore, a single initialization frame may beused to initialize a limited number of slaves, depending on thedimension in bytes of the data field of the initialization frame and onthe amount of data needed by a slave to be properly initialized. Forinstance, if the data field of the initialization frame is e.g., 64bytes long and a slave needs e.g., 3 bytes of data for being correctlyinitialized, up to 21 slaves can be initialized in one CAN FD frame.

In one or more embodiments, a wake-up pattern (WUP) may be implementedas a specific “first” message. The ID of a wake-up pattern may beselected to satisfy the wake-up pattern requirements of ISO11898-2,e.g., with T_(Filter)(short) at 1 Mb/s. In case the communication bus isoperated at lower bit rates, T_(Filter)(long) may be used.

In one or more embodiments, the reserved WUP ID may be “1_000_111_0000”.The WUP may be repeated or enhanced in the optional data bytes of thewake-up frame.

In one or more embodiments, a master 10 may request data from aparticular slave 20 _(i) by sending a “second” message, which can beselected to be a CAN FD frame. The CAN FD ID of a “second” message maycontain the slave ID, e.g., a 9-bit slave ID, as well as a bitidentifying such frame as a “second” message and a bit identifying suchframe as unicast frame.

In one or more embodiments, the Most Significant Bit (MSB) of the CAN FDIDs used in the bus 30 may be equal to “o” if identifying a so-called“unicast” frame, i.e. a frame addressed to a certain slave only, andequal to “1” if identifying a so-called “broadcast” frame, i.e. a frameaddresses to all slaves, there comprising also chain initializationframes and wake-up frames. It will be appreciated that referring to “1”and “0” values, respectively, is merely by way of example: one or moreembodiments may in fact adopt a complementary choice (e.g., “0” and “1”values, respectively).

In one or more embodiments, as a result of a unicast frame notcontaining any data, the addressed slave may transmit the defaultdiagnosis data, as defined at implementation. Otherwise, in case aunicast frame contains data, such data will be an SPI command accordingto ST SPI 4.1 protocol.

In one or more embodiments, a slave receiving a unicast frame containingan SPI command as defined above will reply with the data requested bythe “second” message encoded by the ST SPI 4.1 protocol.

In one or more embodiments, a master 10 may address a slave 20 _(i) bysending a frame which contains the slave ID in the CAN FD ID field. Theoptional data bytes may contain an ST SPI SDI (ST Serial PeripheralInterface Serial Data Input) frame.

In one or more embodiments, a slave 20 _(i) may answer to a received“second” message by sending a reaction message, e.g., a diagnosisresponse frame, over the communication bus 30. The reaction message canbe selected to be a CAN FD frame. The CAN FD ID of a reaction messagemay contain the slave ID, e.g., a 9-bit slave ID, as well as a bitidentifying such frame as a reaction message and a bit identifying suchframe as unicast frame.

In one or more embodiments, the data bytes of a reaction message maycontain an ST SPI SDO (Serial Peripheral Interface Serial Data Output asdeveloped by companies of the ST Group) frame. In case the “second”message received by a slave does not contain data in the frame datafield, the slave may answer to the received “second” message with a CANFD frame whose data bytes may contain the Global Status Byte (GSB) only.

In one or more embodiments, different default replies may be used andspecified in the device datasheet.

Possible uses of the frame ID, e.g., a CAN FD standard frame ID, inembodiments are exemplarily shown in Table 2 below.

TABLE 2 Frame ID Overview Frame Frame ID[10:0] Name Purpose Remark {0,0, Slave ID[8:0]} Unicast Master: Diagnosis Optional Frame request STSPI Protocol in data field {0, 1, Slave ID[8:0]} Unicast Slave:Diagnosis Optional Frame response ST SPI Protocol in data field“1_0110_0000_00” Chain Chain Chain number, Init Initialization positionand associated slave ID in data field {1, 111, chain#[6:0]} BroadcastSend broadcast Chain members Frame data to a may pick their certainchain data from the data field “1_000_111_0000” Wake-Up Broadcast dataAdditional wake- Pattern frame for waking up pattern may up the slavesbe sent in the data field

In one or more embodiments, a protocol controller may implement the CANFD protocol as previously described.

In one or more embodiments, building blocks for implementing CAN FDWake-Up-Frame detection may be used and modified for facilitating theimplementation of a simplified master/slave communication structure,wherein the slaves answer (only) on request by the master.

As already noted, the “first” messages discussed throughout thisdescription essentially correspond to broadcast messages asconventionally transmitted in a message-based protocol such as, e.g., aCAN bus protocol where messages transmitted over the bus by one deviceare (simultaneously) received by (all) the other devices, with theselatter devices capable of implementing respective operations as afunction of operation data portions conveyed by such broadcast messages.Similarly, while so-to-say “physically” broadcast over the bus by one(master) device, the second messages discussed throughout thisdescription are in fact “logically” addressed to individual ones of theother (slave) devices essentially as request messages whereby the slavedevices are requested to react by sending towards the masterdevice—within a certain time interval—a respective response such ase.g., a diagnostic message, with possible collisions of such responsesavoided insofar as the master device allots respective, non-colliding,response intervals to the slave devices.

The first messages may thus be regarded as true “broadcast” messages;conversely, while physically broadcast over the bus 30 by one (master)device, the second messages may be regarded essentially as “unicast”messages, insofar as they are logically addressed to individual ones ofthe slave devices.

In one or more embodiments, a method may comprise:

coupling a first device (e.g., 10) and a set of second devices (e.g., 20₁, 20 ₂, . . . , 20 _(n)) via a bus (e.g., 30),

configuring the first device as a master device to transmit over thebus:

a) first messages carrying a set of operation data message portionsindicative of operations for implementation by second devices in the setof second devices, and

b) second messages addressed to second devices in the set of seconddevices, the second messages conveying identifiers identifyingrespective ones of the second devices to which the second messages areaddressed requesting respective reactions towards the first devicewithin respective expected reaction intervals, and

configuring the second devices as slave devices:

c) to receive over the bus the first messages transmitted from the firstdevice configured as master device, read respective operation datamessage portions in the set of operation data message portions andimplement respective operations as a function of the respectiveoperation data message portions read,

d) to receive over the bus the second messages transmitted from thefirst device configured as master device and react thereon within therespective expected reaction intervals by transmitting over the busreaction messages towards the first device configured as master device.

In one or more embodiments, a first device configured as master devicemay transmit over a bus initialization messages comprisinginitialization data indicative of which operation data message portionsin first messages transmitted over the bus from the first deviceconfigured as master device are dedicated to respective ones of seconddevices configured as slave devices, and second devices configured asslave devices may receive the initialization messages transmitted overthe bus from the first device configured as master device and mayinitialize as a function of the initialization data to read respectiveoperation data message portions dedicated thereto in the set ofoperation data message portions.

In one or more embodiments, a method may comprise arranging seconddevices in a set of second devices configured as slave devices insubsets of second devices, wherein a first device configured as masterdevice may transmit over a bus first messages comprising subsetidentification indexes identifying the subsets of the second devices towhich first operation messages are dedicated.

In one or more embodiments, a first device configured as master devicemay transmit first messages over a bus at a constant rate.

In one or more embodiments, second devices in a set of second devicesmay switch to a fail-safe state as a result of expiration of respectivewatchdog timers.

In one or more embodiments, second devices in a set of second devicesmay reset respective watchdog timers as a result of receiving from afirst device configured as master device messages selected out of firstmessages and second messages.

In one or more embodiments, a first device may be sensitive torespective reactions requested from second devices in a set of seconddevices failing to reach the first device within respective expectedreaction intervals, and/or may trigger respective watchdog error signalsindicative of second devices in a set of second devices from whichrespective reactions fail to reach the first device within respectiveexpected reaction intervals.

In one or more embodiments, a bus may comprise a differential wiringbus.

In one or more embodiments, a system may comprise a first device (e.g.,10) and a set of second devices (e.g., 20 ₁, 20 ₂, . . . , 20 _(n))coupled via a bus (e.g., 30), wherein the first device and the seconddevices may be configured as master device and slave devices,respectively, and the master device and the slave devices may beconfigured to operate with the method of one or more embodiments.

In one or more embodiments, a device (e.g., 10) for coupling as a firstdevice to a set of second devices (e.g., 20 ₁, 20 ₂, . . . , 20 _(n))via a bus (e.g., 30) may be configured to transmit over the bus:

first messages carrying a set of operation data message portionsindicative of operations for implementation by second devices in the setof second devices, and second messages addressed to second devices inthe set of second devices, the second messages requesting respectivereactions towards the first device within respective expected reactionintervals, the second messages conveying identifiers identifyingrespective ones of the second devices to which the second messages areaddressed.

In one or more embodiments, a device for coupling as a first device to aset of second devices via a bus may be sensitive to respective reactionsrequested from second devices in the set of second devices failing toreach the first device within respective expected reaction intervals,and/or may be configured to trigger respective watchdog error signalsindicative of second devices in the set of second devices from whichrespective reactions fail to reach the first device within respectiveexpected reaction intervals.

In one or more embodiments, a device (e.g., 20 _(i)) for inclusion in aset of second devices (e.g., 20 ₁, 20 ₂, . . . , 20 _(n)) coupled to afirst device (e.g., 10) via a bus (e.g., 30) may be configured to:

receive over the bus first messages carrying a set of operation datamessage portions indicative of operations for implementation by seconddevices in the set of second devices, read at least one respectiveoperation data message portion in the set of operation data messageportions and implement at least one respective operation as a functionof the at least one respective operation data message portion read,

receive over the bus respective second messages conveying identifiersidentifying the device as the one of the second devices to which therespective second messages are addressed, the respective second messagesrequesting from the device respective reactions towards the first devicewithin respective expected reaction intervals, and react thereon withinthe respective expected reaction intervals, wherein reaction messagesfrom the device are transmitted over the bus towards the first deviceconfigured as master device.

In one or more embodiments, a device for inclusion in a set of seconddevices coupled to a first device via a bus may be configured to switchto a fail-safe state as a result of expiration of a respective watchdogtimer.

In one or more embodiments, a device for inclusion in a set of seconddevices coupled to a first device via a bus may be configured to reset arespective watchdog timer as a result of messages received from thefirst device via the bus.

In one or more embodiments, a device for inclusion in a set of seconddevices coupled to a first device via a bus may comprise a HWcommunication and protocol controller (e.g., 201) comprisingapplication-specific hardware implemented therein.

In one or more embodiments, a device for inclusion in a set of seconddevices coupled to a first device via a bus may comprise alight-radiation source driver, preferably a vehicle light driver.

In one or more embodiments, a vehicle (e.g., V) may be equipped with asystem according to one or more embodiments.

In one or more embodiments, a signal transmissible over a bus (e.g., 30)to transmit messages from a first device (e.g., 10) to a set of seconddevices (e.g., 20 ₁, 20 ₂, . . . , 20 _(n)) in a system according to oneor more embodiments may comprise:

first messages carrying a set of operation data message portionsindicative of operations for implementation by second devices in the setof second devices, and second messages addressed to second devices inthe set of second devices, the second messages requesting respectivereactions towards the first device within respective expected reactionintervals, the second messages conveying identifiers identifyingrespective ones of the second devices to which the second messages areaddressed.

In one or more embodiments, a signal transmitting first messagescarrying a set of operation data message portions dedicated to seconddevices configured as slave devices may occur at a constant rate.

Without prejudice to the underlying principles, the details andembodiments may vary, even significantly, with respect to what has beendescribed by way of example only, without departing from the extent ofprotection.

The extent of protection is defined by the annexed claims.

What is claimed is:
 1. A method of operating a system that comprises amaster device and a set of slave devices coupled via a differentialwiring bus, the method comprising: encoding first messages in a CAN FDformat, the first messages comprising a set of operation data messageportions indicative of operations for implementation by slave devices ofthe set of slave devices; transmitting the first messages from themaster device over the differential wiring bus; encoding second messagesaddressed to the slave devices in the set of slave devices in the CAN FDformat, the second messages comprising identifiers identifyingrespective ones of the slave devices to which the second messages areaddressed requesting respective reactions towards the master devicewithin respective expected reaction intervals; transmitting the secondmessages from the master device over the differential wiring bus;receiving, by the slave devices, the first messages transmitted from themaster device; reading, by the slave devices, respective operation datamessage portions in the set of operation data message portions;implementing, by the slave devices, respective operations as a functionof the respective operation data message portions read; receiving, bythe slave devices, the second messages transmitted from the masterdevice; and reacting, by the slave devices, on the second messageswithin the respective expected reaction intervals by transmittingreaction messages over the differential wiring bus towards the masterdevice.
 2. The method of claim 1, further comprising: transmitting, bythe master device, initialization messages comprising initializationdata indicative of which operation data message portions in the firstmessages transmitted over the differential wiring bus from the masterdevice are dedicated to respective ones of the slave devices; andreceiving, by the slave devices, the initialization messages andinitializing, as a function of the initialization data, reading ofrespective operation data message portions dedicated thereto in the setof operation data message portions.
 3. The method of claim 1, whereinthe slave devices are arranged in subsets of slave devices and whereintransmitting first messages from the master device comprisestransmitting first messages comprising subset identification indexesidentifying the subsets of the slave devices to which the first messagesare dedicated.
 4. The method of claim 1, wherein the master devicetransmits the first messages over the differential wiring bus at aconstant rate.
 5. The method of claim 1, wherein slave devices in theset of slave devices switch to a fail-safe state as a result ofexpiration of respective watchdog timers.
 6. The method of claim 5,wherein the slave devices in the set of slave devices reset therespective watchdog timers as a result of receiving messages selectedout of the first messages and the second messages.
 7. The method ofclaim 1, wherein the master device is sensitive to respective reactionsrequested from slave devices in the set of slave devices failing toreach the master device within the respective expected reactionintervals.
 8. The method of claim 1, wherein the master device triggersrespective watchdog error signals indicative of slave devices in the setof slave devices from which respective reactions fail to reach themaster device within the respective expected reaction intervals.
 9. Adevice, comprising: a master device comprising: a protocol controllercircuit configured to encode first messages and second messages in a CANFD format, and a CAN FD transceiver circuit configured to transmit thefirst messages and the second messages via a differential wiring bus,wherein the first messages comprise set of operation data messageportions indicative of operations for implementation by slave devices ofa set of slave devices, the second messages are addressed to the slavedevices in the set of slave devices, and the second messages compriseidentifiers identifying respective ones of the slave devices to whichthe second messages are addressed requesting respective reactionstowards the master device within respective expected reaction intervals;and the set of slave devices comprising respective communication andprotocol controller circuits configured to: receive over thedifferential wiring bus the first messages transmitted from the masterdevice, read respective operation data message portions in the set ofoperation data message portions, implement respective operations as afunction of the respective operation data message portions read, receiveover the differential wiring bus the second messages transmitted fromthe master device, and react on the second messages within therespective expected reaction intervals by transmitting reaction messagesover the differential wiring bus towards the master device.
 10. Thedevice of claim 9, wherein: the master device is configured to transmitinitialization messages comprising initialization data indicative ofwhich operation data message portions in the first messages transmittedover the differential wiring bus from the master device are dedicated torespective ones of the slave devices; and the slave devices areconfigured to receive the initialization messages transmitted over thedifferential wiring bus from the master device and to initialize, as afunction of the initialization data, to read respective operation datamessage portions dedicated thereto in the set of operation data messageportions.
 11. The device of claim 9, wherein the slave devices arearranged in subsets of slave devices and wherein the master device isconfigured to transmit first messages comprising subset identificationindexes identifying the subsets of the slave devices to which the firstmessages are dedicated.
 12. The device of claim 9, wherein the masterdevice is configured to transmit the first messages over thedifferential wiring bus at a constant rate.
 13. The device of claim 9,wherein slave devices in the set of slave devices are configured toswitch to a fail-safe state as a result of expiration of respectivewatchdog timers.
 14. The device of claim 13, wherein the slave devicesin the set of slave devices are configured to reset the respectivewatchdog timers as a result of receiving messages selected out of thefirst messages and the second messages.
 15. The device of claim 9,wherein the master device is sensitive to respective reactions requestedfrom slave devices in the set of slave devices failing to reach themaster device within the respective expected reaction intervals.
 16. Amaster device configured to communicate with a set of slave devices viaa differential wiring bus, the master device comprising: a protocolcontroller circuit configured to be coupled to the differential wiringbus, the protocol controller circuit configured to: encode firstmessages and second messages in a CAN FD format, and transmit the firstmessages and the second messages, wherein the first messages comprise aset of operation data message portions indicative of operations forimplementation by slave devices in the set of slave devices, and thesecond messages are addressed to the slave devices in the set of slavedevices, the second messages are configured to request respectivereactions towards the master device within respective expected reactionintervals, and the second messages comprise identifiers identifyingrespective ones of the slave devices to which the second messages areaddressed.
 17. The master device of claim 16, wherein the master device:is sensitive to respective reactions requested from slave devices in theset of slave devices failing to reach the master device within therespective expected reaction intervals; or is configured to triggerrespective watchdog error signals indicative of slave devices in the setof slave devices from which respective reactions fail to reach themaster device within the respective expected reaction intervals.
 18. Themaster device of claim 16, wherein the master device is configured totransmit the first messages at a constant rate.
 19. A slave device forinclusion in a set of slave devices coupled to a master device via adifferential wiring bus, the slave device comprising: a communicationand protocol controller circuit configured to: receive, over thedifferential wiring bus, first messages encoded in a CAN FD format andcarrying a set of operation data message portions indicative ofoperations for implementation by slave devices in the set of slavedevices; read at least one respective operation data message portion inthe set of operation data message portions; implement at least onerespective operation as a function of the at least one respectiveoperation data message portion read; receive, over the differentialwiring bus, respective second messages conveying identifiers identifyingthe slave device as the one of the slave devices to which the respectivesecond messages are addressed, the respective second messages requestingrespective reactions towards the master device within respectiveexpected reaction intervals; and react on the respective second messageswithin the respective expected reaction intervals, wherein reactionmessages are to be transmitted from the slave device over thedifferential wiring bus towards the master device.
 20. The slave deviceof claim 19, wherein the communication and protocol controller circuitis configured to switch to a fail-safe state as a result of expirationof a respective watchdog timer.
 21. The slave device of claim 20,wherein the communication and protocol controller circuit is configuredto reset the respective watchdog timer as a result of messages receivedfrom the master device via the bus.
 22. The slave device of claim 19,wherein the communication and protocol controller circuit comprisesapplication-specific hardware.
 23. The slave device of claim 19, whereinthe slave device is a light-radiation source driver.
 24. The slavedevice of claim 23, wherein the slave device is a vehicle light driver.